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DATA PROTECTI ON ACT 1998 


SUPERVI SORY POWERS OF THE I NFORMATI ON COMMI SSI ONER 


MONETARY PENALTY NOTI CE 


Reliance Advisory Limited 


Topley House, 52 Wash Lane, Bury, BL9 6AS 


The Information Commissioner (“Commissioner”) is minded to issue 
Reliance Advisory Limited (“Reliance Advisory”) with a monetary 
penalty under section 55A of the Data Protection Act 1998 (“DPA”). The 
penalty is being issued because of serious contraventions of regulation 
21A of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Reliance Advisory, whose registered office is given above (Companies 
House Registration Number: 09888100) is the organisation stated in 
this notice to have used a public electronic communications service for 
the purpose of making unsolicited calls for the purposes of direct 
marketing in relation to claims management services contrary to 
regulation 21A of PECR. 


Regulation 21A paragraph (1) of PECR provides that: 
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“(1) A person must not use, or instigate the use of, a public electronic 
communications service to make unsolicited calls for the 
purposes of direct marketing in relation to claims management 


services except in the circumstances referred to in paragraph 
(2).” 


5: Regulation 21A paragraphs (2), and (3) provide that: 
“(2) Those circumstances are where the called line is that of a 
subscriber who has previously notified the caller that for the time 


being the subscriber consents to such calls being made by, or at 


the instigation of, the caller on that line 


(3) A subscriber must not permit the subscriber's line to be used in 


contravention of paragraph (1).” 


6. Regulation 21A paragraphs (4), and (5) materially state that: 


“(4) In this regulation “claims management services” means the 
following services in relation to the making of a claim— 


advice; 


financial services or assistance; 


) 

) 

) acting on behalf of, or representing, a person; 

) the referral or introduction of one person to another; 
) 


the making of inquiries. 


(5) In paragraph (4), “claim” means a claim for compensation, 
restitution, repayment or any other remedy or relief in respect of 


Information Commissioner's Office 


loss or damage or in respect of an obligation, whether the claim is 
made or could be made— 


(a) by way of legal proceedings, 
(b) in accordance with a scheme of regulation (whether 


voluntary or compulsory), or 


(c) in pursuance of a voluntary undertaking. 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Under section 55A (1) of the DPA (as amended by the Privacy and 
Electronic Communications (EC Directive) (Amendment) Regulations 
2011 and the Privacy and Electronic Communications (EC Directive) 
(Amendment) Regulations 2015) the Commissioner may serve a 
person with a monetary penalty notice if the Commissioner is satisfied 
that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 


2003 by the person, and 


(b) subsection (2) or (3) applies. 
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(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 
The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 


paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 
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Reliance Advisory first came to the attention of the Commissioner 
following the receipt of a number of complaints from subscribers in 
relation to a number of Calling Line Identities (“CLI’s”). The 
complainants indicated that the calls were made by Reliance Advisory 


or what appeared to be a linked organisation, registered at the same 


business address and sharing two of the same company directors. 


Between 1 January 2019 and 30 June 2019, the ICO received 85 
complaints about unsolicited direct marketing calls made by Reliance 


Advisory. 


The Commissioner, through enquiries with the relevant 
Communications Service Provider (“CSP”), was able to establish that 
the CLI’s in question were allocated to Reliance Advisory. However, 
several of CLI’s appeared to be allocated to both Reliance Advisory and 


its linked company. 


The Commissioner sent an initial investigation letter to Reliance 
Advisory on 10 December 2019, setting out her concerns with the 
organisation’s compliance with PECR, enquiring about its relationship 
with the linked company and requesting information which would assist 


in her investigation. 


In its responses to the Commissioner on 10 January 2020 and 19 
February 2020 Reliance Advisory described itself as a lead generation 
company for claims management services. It confirmed that the data 
used for its calls was purchased from a third party data provider. In 
response to the Commissioner’s request for evidence of consent for the 
complaints received, Reliance Advisory stated that it was unable to 
provide each individual specific opt in due to the length of time since 


the data was purchased. It advised they could only request details of 
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the consents within 30 days and therefore they were unable to provide 


evidence of the specific consent in relation to the complaints. 


Open source research was conducted by the Commissioner on the 
website from which Reliance Advisory advised the consents would have 
been obtained from. It was apparent that the means by which consent 
was obtained did not allow for it to be freely given, specific, or 
informed. In order to sign up to the site, users are required to provide 
their name, address, email address, telephone number, and date of 
birth. The website includes a consent statement and tick box, which 


states: 


“I consent to allowing xxx to process your registration and to use the 
data you supply to show you targeted offers and marketing 
communications from our partners. You have read and agree to the 
terms and conditions & privacy policy. | consent that our partners and 


their partners may contact me by email, phone, SMS or post.” 


Individuals are unable to proceed to click the “next step” button 
without providing consent at this point. Furthermore, individuals are 
not able to select which sectors or individual companies they wish to 
provide consent to. Clicking on the “partners” link shows Reliance 
Advisory are listed as a partner, along with 7 other companies under 
the “Claims Compensation” header. In total, 151 partners are listed on 
the site. Therefore, users would be consenting to receive 
correspondence from not only the 151 named partners, but their 


partners as well. 


The complaints received by the Commissioner relating to CLIs allocated 


to Reliance Advisory include: 
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“My bank had informed me that | had a refund, wanted my address 


and bank details. Knew my name. Made me very uncomfortable.” 


“I was working, and | am fed up with a spate (the last 14 days) of 
these calls. | challenged how he got my number; he said it was in his 
database. | told him he was in breach of GDPR, to which he responded 
he was regulated by the Ministry of J ustice. | told him he was still in 
breach of the law; he asked if | was covered recently by GDPR and did 
| opt out. | responded, ‘its the law, everyone is covered, and there is 


no requirement for me to ‘opt out" He put the phone down.” [sic] 


“| don't know as the first time they called | couldn't hear them 
properly, they just mumbled. I've tried blocking their number, but they 
keep calling.” 


“They call when my baby is asleep and wake her up. They disrupt my 
day. My husband is in the military and can rarely call me, when they 


call, | think it's him and then I'm disappointed it's them again.” 


“I've been receiving calls from this number (and similar ones - 
Manchester code) for a while. My number is on the TPS service and has 
been for some time. | spoke to a 'Kieran' who, when | said that my 
number was registered with TPS and that | have complained, laughed 
and said 'I very much doubt you have'. They are in breach of GDPR 


regulations having my details and continuing to call.” 


Reliance confirmed to the Commissioner on 4 February 2020 that a 


total of 15,119,545 calls were made to new potential customers 
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between 1 January and 30 June 2019. 1,197,390 of these calls were 


connected. 


The Commissioner is satisfied that 1,197,390 calls were all made for 
the purposes of ‘claims management services’ as defined at Regulation 
21A(4) PECR. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21A of PECR by Reliance Advisory and, if 


so, whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that Reliance Advisory contravened regulation 
21A of PECR. 


The Commissioner finds that the contraventions were as follows: 


Regulation 21A was brought into force on 8 September 2018 and 
requires that persons/organisations hold consent from subscribers in 


order to make calls relating to claims management services. 


Between 1 January 2019 and 30 June 2019, Reliance Advisory used a 
public electronic communications service for the purpose of making 
1,197,390 unsolicited calls for direct marketing purposes to subscribers 
in relation to claims management services. This resulted in 85 


complaints being made to the TPS and the Commissioner. 
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The Commissioner is satisfied for the purposes of regulation 21A that 


these calls were made to subscribers who had not given their prior 


consent to Reliance Advisory to receive such calls. 


The Commissioner is satisfied that Reliance Advisory was responsible 


for these contraventions. 


The Commissioner has gone on to consider whether the conditions 
under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contraventions identified 

above were serious. This is because there have been multiple breaches 
of regulation 21A by Reliance Advisory over a six month period. 
Specifically, between 1 January 2019 and 30 June 2019 made a total of 
15,119,545 calls relating to claims management services to 
subscribers, 1,197,390 of these calls were connected. This led to a 
significant number of complaints about unsolicited direct marketing 


calls in relation to claims management services. 


The legislation is clear that TPS registration is not a relevant 
consideration in respect of such calls. A subscriber must have 
previously notified the caller that for the time being the subscriber 
consents to such calls being made by, or at the instigation of, the caller 
on that line. The Commissioner is satisfied that Reliance Advisory did 


not have the necessary consent to make these calls. 


Reliance Advisory used aggressive tactics when making the calls to 
subscribers, aS evidenced by the content of some of the complaint 


extracts: 
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“Asking about PPI she said has been given information about my PPI 
(not true). | told her she shouldnt be calling and she became very 


rude. | told her that | hadnt given permission for PPI calls and it was 


illegal. she became rude and loud” [sic]” 


“They have called me approximately 5 times over the past few weeks, 
every time they call | ask them to take me off their system as | am not 
interested. | told them this time | will be making a compliant to the 
ICO, which they then went on to say that | can’t do that because | 
hang up on them. So this time | left my phone on the side until they 


hung up.” 


“They are trying to get me to claim PPI from an address | moved from 
6 years ago. They refused to give details from where they got my 
details and refused to confirm they had my details removed from the 
system. They were aggressive and refused to answer questions about 


where my details have come from.” 


“The call concluded with the operator telling me to 'F*** off' after | 


told her | was not interested.” 


“| recieve 3 or 4 calls a day from this number. | have asked them to 
stop calling and now they are calling 3 or 4 times a day. | have just 
lost my mum and have told them to stop but they have been making 


more calls.” [sic] 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 
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The Commissioner has considered whether the contraventions 
identified above were deliberate. In the Commissioner's view, this 
means that Reliance Advisory’s actions which constituted that 
contravention were deliberate actions (even if Reliance Advisory did not 


actually intend thereby to contravene PECR). 


The Commissioner does not consider that Reliance Advisory 


deliberately set out to contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether Reliance Advisory knew or ought 
reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least because the issue of unsolicited calls in relation to claims 
management services has been widely publicised by the media as 
being a problem, so much so that it prompted recent legislative change 
to prohibit the making of such calls unless certain conditions are met. 
It is reasonable to suppose that any organisation wishing to carry out 
such activities should, and indeed must, be aware of its responsibilities 


in this area. 


The Commissioner has published detailed guidance on her website for 
those carrying out direct marketing calls for the purposes of claims 
management services, explaining the strict criteria under which such 
calls can be made. This guidance explains such calls must not be made 
in relation to claims management services unless the individual being 
called has specifically consented to such calls or has a defined existing 


client relationship. 
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Secondly, the Commissioner has gone on to consider whether Reliance 
Advisory failed to take reasonable steps to prevent the contraventions. 
Again, she is satisfied that this condition is met. Whilst evidence 
provided by Reliance Advisory suggests that some steps were taken to 
ensure that its data providers obtained valid consent for the purposes 
of direct marketing calls it should have been apparent that further 
consent was required to make calls in relation to claims management 


services. 


The Commissioner is of the view that if Reliance Advisory had 
familiarised itself with the relevant legislation and guidance and set its 
due diligence checks accordingly, it would have realised that it could 
not lawfully make unsolicited direct marketing calls for the purposes of 


claims management services. 


Given the volume of calls and complaints, it is clear that Reliance 


Advisory failed to take those reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to impose a monetary penalty 


For the reasons explained above the Commissioner is satisfied that the 
conditions from section 55A(1)DPA have been met in this case. She is 
also satisfied that section 55A(3)DPA and the procedural rights under 


section 55B have been complied with. 


The latter has included the issuing of a Notice of Intent dated 4 August 


2020 in which the Commissioner set out her preliminary thinking. 
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The Commissioner has considered whether, in the circumstances she 
should exercise her discretion so as to issue a monetary penalty. In 
reaching her final view, the Commissioner has taken into account 
representations made by Reliance Advisory Limited dated 28 August 


2020 however there is nothing contained therein to dissuade the 


Commissioner from her preliminary view. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The amount of the penalty 


The Commissioner has taken into account the following mitigating 


features of this case: 


Reliance Advisory appear to have employed aggressive and rude 
practices as reported to the Commissioner by subscribers. The 
complaints detail how subscribers received persistent and repeated 
calls resulting in several calls, multiple times per day. This 
demonstrates a high degree of intrusion into the privacy of 


subscribers; 


The purpose of these calls was to generate leads. The making of the 
calls of this nature will always be for financial gain as the company will 


profit for any business resulting from the calls. 


Advice and Guidance is published on the Commissioner’s website and 
is also available via the Commissioner’s Advice Services. The restriction 
on unsolicited claims management calls was widely publicised within 
the industry and the wider media. As such, it is highly unlikely that the 
directors and otherwise responsible persons were not aware of their 
regulatory obligations. 


13 


49. 


50. 


51. 


52. 


53. 


ICO. 


Information Commissioner’s Office 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


Taking into account all of the above, the Commissioner has decided 
that the amount of the penalty is £250,000 (Two hundred and fifty 


thousand pounds) 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 27 November 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
26 November 2020 the Commissioner will reduce the monetary 
penalty by 20% to £200,000 (Two hundred thousand pounds). 
However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 
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(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 27" day of October 2020 
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Andy Curry 

Head of Investigations 

Regulatory Supervision Service 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a 
right of appeal to the First-tier Tribunal (Information Rights) (the 
‘Tribunal’) against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) 


b) 


that the notice against which the appeal is brought is not in 
accordance with the law; or 


to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 
discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 
Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


GRC & GRP Tribunals 
PO Box 9300 
Arnhem House 

31 Waterloo Way 
Leicester 

LE1 8DJ 


The notice of appeal should be sent so it is received by the 
Tribunal within 28 days of the date of the notice. 


17 


1CO. 


Information Commissioner's Office 


b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your representative 
(if any); 


b) an address where documents may be sent or delivered to you; 
C) the name and address of the Information Commissioner; 

d) details of the decision to which the proceedings relate; 

e) the result that you are seeking; 

f) the grounds on which you rely; 


o) you must provide with the notice of appeal a copy of the 
monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 
reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 
he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 
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